Okay, so I'm playing devil's advocate here: One good reason is usability. Users are forgetting their passwords all the time and as buttscicles pointed out it i

Okay, so I'm playing devil's advocate here: One good reason is usability. Users are forgetting their passwords all the time and as buttscicles pointed out it is for a lot of people much easier to just get an email with their password instead of going through the whole set-a-new-password-flow. We actually tested that 8+ years ago and although I don't recall the exact numbers, sending the password lead to much higher login rates than creating a new password. And I really mean _much_ higher. Plus from a security perspective it's always better to secure the access to the DB instead of trying to minimize the damage. And btw the still common (unsalted) MD5 hashing of passwords is barely better than plain passwords.